It is commonplace today for computer users to connect their machines to other computers, and particularly, servers, throughout a network. The network may be a private network, such as a corporate intranet of networked computers that is accessible only to computer users within that corporation, or it may be a public network, such as the Internet. The Internet is well known as a vast collection of computing resources, interconnected as a network, from sites around the world.
A user may connect his computer to a server using a “wireline” connection or a “wireless” connection. Wireline connections are those that use physical media (such as cables, optical fibers or telephone lines) to provide a connection, whereas wireless connections use media such as satellite links, radio frequency waves, and infrared waves. Many connection techniques can be used with these various media, including: using the computer's modem to establish a connection over a telephone line; using a local area network (LAN) card such as Token Ring or Ethernet; using a cellular modem to establish a wireless connection, and the like. The user's computer may be any type of device having processing and communication capabilities. Traditionally, such devices include desktop, laptop and handheld computers.
Conventional user ID and password schemes for controlling user access to network resources are also well known. Recently, it has been proposed to provide client workstations in a network with so-called “alternative” authentication devices for access control purposes. Such devices include, for example, “token cards” and “biometric” (e.g., finger, eye or voice print) scanners. One problem with these current alternatives is that each authentication device vendor has a different way of encoding input information and validating the user's identity.
In a multiuser computer system, identification and authentication mechanisms are essential for identifying and authenticating each individual who requests any usage of system resources. The most common implementation of such mechanisms is a user identification (ID) along with a password. Thus, each multiuser computer system contains, as a minimum, a unique sign-on ID for each registered user to the system. This allows for accountability of system usage down to the individual user level.
However, when such user identification and authentication implementation methodology is extrapolated to more than one computer system within a distributed computing environment, a user must repeatedly provide a user ID along with an appropriate password in order to gain access to each computer system. For a user who wishes to gain access to several different services within a single session, each provided by a different computer system, this repetitious sign-on procedure tends to be very tedious (if not annoying). In most cases, in particular, the user ID and password must be transmitted to a remote computer system. Without a secure path between the user's computer system and the remote computer system, anyone who has access to the distributed computing environment could use a network analyzer to discover the user ID and password of the user. As such, the effectiveness of the sign-on procedure as a means of security measure may be undermined.
One solution for single sign-on and authentication in a distributed computing environment is known as “Kerberos”. Kerberos is an authentication protocol developed as part of Project Athena at MIT and provides a platform for single sign-on and authentication in an open network environment. Unfortunately, Kerberos support is not transparent and requires various custom modifications to the required applications and system utilities in order to perform adequately in various circumstances.